# Vulnerabilities published in 2016


- [CVE-2016-6438](https://insights.sbomify.com/CVE-2016-6438/): Missing authorization in Cisco IOS XE 3.16S, 3.17S, 3.18.0S, 3.18.1S, 3.18.0SP (medium 5.9)
- [CVE-2016-6437](https://insights.sbomify.com/CVE-2016-6437/): Denial of service in Cisco Wide Area Application Services (WAAS) before 5.3(5g)1 and 6.x before 6.2(2.32) (medium 5.9)
- [CVE-2016-6436](https://insights.sbomify.com/CVE-2016-6436/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2016-6435](https://insights.sbomify.com/CVE-2016-6435/): Path traversal in n/a (medium 6.5)
- [CVE-2016-6434](https://insights.sbomify.com/CVE-2016-6434/): Hardcoded credentials in n/a (high 7.8)
- [CVE-2016-6433](https://insights.sbomify.com/CVE-2016-6433/): Command injection in n/a (high 8.8)
- [CVE-2016-6432](https://insights.sbomify.com/CVE-2016-6432/): Memory corruption in Cisco ASA Software before 9.6(2.1) (high 8.1)
- [CVE-2016-6431](https://insights.sbomify.com/CVE-2016-6431/): Denial of service in Cisco ASA Software before 9.6(1.5) (high 7.5)
- [CVE-2016-6430](https://insights.sbomify.com/CVE-2016-6430/): A vulnerability in the command-line interface of the Cisco IP Interoperability and Collaboration System (IPICS) could allow an authenticated (high 7.8)
- [CVE-2016-6429](https://insights.sbomify.com/CVE-2016-6429/): Cross-site scripting in Cisco IP Interoperability and Collaboration System 4.10(1) (medium 6.1)
- [CVE-2016-6428](https://insights.sbomify.com/CVE-2016-6428/): Command injection in n/a (high 7.8)
- [CVE-2016-6427](https://insights.sbomify.com/CVE-2016-6427/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2016-6426](https://insights.sbomify.com/CVE-2016-6426/): Missing authorization in n/a (high 7.5)
- [CVE-2016-6425](https://insights.sbomify.com/CVE-2016-6425/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2016-6424](https://insights.sbomify.com/CVE-2016-6424/): Denial of service in n/a (medium 6.5)
- [CVE-2016-6423](https://insights.sbomify.com/CVE-2016-6423/): Denial of service in n/a (medium 6.5)
- [CVE-2016-6422](https://insights.sbomify.com/CVE-2016-6422/): Security feature bypass in n/a (high 7.5)
- [CVE-2016-6421](https://insights.sbomify.com/CVE-2016-6421/): Denial of service in n/a (medium 5.3)
- [CVE-2016-6420](https://insights.sbomify.com/CVE-2016-6420/): Missing authorization in n/a (medium 6.5)
- [CVE-2016-6419](https://insights.sbomify.com/CVE-2016-6419/): SQL injection in n/a (high 7.5)
- [CVE-2016-6418](https://insights.sbomify.com/CVE-2016-6418/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2016-6417](https://insights.sbomify.com/CVE-2016-6417/): Cross-site request forgery in n/a (high 8.8)
- [CVE-2016-6416](https://insights.sbomify.com/CVE-2016-6416/): Denial of service in n/a (medium 5.9)
- [CVE-2016-6415](https://insights.sbomify.com/CVE-2016-6415/): Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure (high 7.5, exploited in the wild)
- [CVE-2016-6414](https://insights.sbomify.com/CVE-2016-6414/): Command injection in n/a (high 7.8)
- [CVE-2016-6413](https://insights.sbomify.com/CVE-2016-6413/): Privilege escalation in n/a (high 7.8)
- [CVE-2016-6412](https://insights.sbomify.com/CVE-2016-6412/): Other in n/a (medium 6.5)
- [CVE-2016-6411](https://insights.sbomify.com/CVE-2016-6411/): Security feature bypass in n/a (high 7.5)
- [CVE-2016-6410](https://insights.sbomify.com/CVE-2016-6410/): Path traversal in n/a (medium 6.5)
- [CVE-2016-6409](https://insights.sbomify.com/CVE-2016-6409/): Denial of service in n/a (high 7.5)
- [CVE-2016-6408](https://insights.sbomify.com/CVE-2016-6408/): XML external entity in n/a (high 7.5)
- [CVE-2016-6407](https://insights.sbomify.com/CVE-2016-6407/): Denial of service in n/a (high 7.5)
- [CVE-2016-6406](https://insights.sbomify.com/CVE-2016-6406/): Auth bypass in n/a (critical 9.8)
- [CVE-2016-6405](https://insights.sbomify.com/CVE-2016-6405/): Missing authorization in n/a (medium 6.5)
- [CVE-2016-6404](https://insights.sbomify.com/CVE-2016-6404/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2016-6403](https://insights.sbomify.com/CVE-2016-6403/): Denial of service in n/a (medium 5.9)
- [CVE-2016-6402](https://insights.sbomify.com/CVE-2016-6402/): Privilege escalation in n/a (high 7.8)
- [CVE-2016-6401](https://insights.sbomify.com/CVE-2016-6401/): Denial of service in n/a (medium 5.3)
- [CVE-2016-6399](https://insights.sbomify.com/CVE-2016-6399/): Denial of service in n/a (high 7.5)
- [CVE-2016-6398](https://insights.sbomify.com/CVE-2016-6398/): Information disclosure in n/a (medium 5.3)
- [CVE-2016-6397](https://insights.sbomify.com/CVE-2016-6397/): Auth bypass in Cisco IPICS 4.8(1) to 4.10(1) (critical 9.8)
- [CVE-2016-6396](https://insights.sbomify.com/CVE-2016-6396/): Security feature bypass in n/a (medium 5.3)
- [CVE-2016-6395](https://insights.sbomify.com/CVE-2016-6395/): Cross-site scripting in n/a (medium 5.4)
- [CVE-2016-6394](https://insights.sbomify.com/CVE-2016-6394/): Auth bypass in n/a (critical 9.1)
- [CVE-2016-6393](https://insights.sbomify.com/CVE-2016-6393/): Denial of service in n/a (high 7.5)
- [CVE-2016-6392](https://insights.sbomify.com/CVE-2016-6392/): Denial of service in n/a (high 7.5)
- [CVE-2016-6391](https://insights.sbomify.com/CVE-2016-6391/): Denial of service in n/a (high 7.5)
- [CVE-2016-6386](https://insights.sbomify.com/CVE-2016-6386/): Denial of service in n/a (high 7.5)
- [CVE-2016-6385](https://insights.sbomify.com/CVE-2016-6385/): Denial of service in n/a (high 7.5)
- [CVE-2016-6384](https://insights.sbomify.com/CVE-2016-6384/): Denial of service in n/a (high 7.5)
- [CVE-2016-6382](https://insights.sbomify.com/CVE-2016-6382/): Denial of service in n/a (high 7.5)
- [CVE-2016-6381](https://insights.sbomify.com/CVE-2016-6381/): Denial of service in n/a (high 7.5)
- [CVE-2016-6380](https://insights.sbomify.com/CVE-2016-6380/): Information disclosure in n/a (high 8.1)
- [CVE-2016-6379](https://insights.sbomify.com/CVE-2016-6379/): Denial of service in n/a (high 7.5)
- [CVE-2016-6378](https://insights.sbomify.com/CVE-2016-6378/): Denial of service in n/a (high 7.5)
- [CVE-2016-6377](https://insights.sbomify.com/CVE-2016-6377/): Auth bypass in n/a (high 8.1)
- [CVE-2016-6376](https://insights.sbomify.com/CVE-2016-6376/): Denial of service in n/a (medium 6.5)
- [CVE-2016-6375](https://insights.sbomify.com/CVE-2016-6375/): Denial of service in n/a (medium 5.3)
- [CVE-2016-6374](https://insights.sbomify.com/CVE-2016-6374/): Command injection in n/a (critical 9.8)
- [CVE-2016-6373](https://insights.sbomify.com/CVE-2016-6373/): Command injection in n/a (high 7.2)
- [CVE-2016-6372](https://insights.sbomify.com/CVE-2016-6372/): Security feature bypass in Cisco AsyncOS through WSA10.0.0-000 (high 7.5)
- [CVE-2016-6371](https://insights.sbomify.com/CVE-2016-6371/): Path traversal in n/a (high 7.5)
- [CVE-2016-6370](https://insights.sbomify.com/CVE-2016-6370/): Path traversal in n/a (medium 4.3)
- [CVE-2016-6369](https://insights.sbomify.com/CVE-2016-6369/): Privilege escalation in n/a (high 7.8)
- [CVE-2016-6368](https://insights.sbomify.com/CVE-2016-6368/): Denial of service in Cisco Firepower Detection Engine (high 8.6)
- [CVE-2016-6367](https://insights.sbomify.com/CVE-2016-6367/): Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution (high 7.8, exploited in the wild)
- [CVE-2016-6366](https://insights.sbomify.com/CVE-2016-6366/): Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow (high 8.8, exploited in the wild)
- [CVE-2016-6365](https://insights.sbomify.com/CVE-2016-6365/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2016-6364](https://insights.sbomify.com/CVE-2016-6364/): Information disclosure in n/a (high 7.5)
- [CVE-2016-6363](https://insights.sbomify.com/CVE-2016-6363/): The rate-limit feature in the 802.11 protocol implementation on Cisco Aironet 1800, 2800, and 3800 devices with software before 8.2.121.0 an (medium 6.5)
- [CVE-2016-6362](https://insights.sbomify.com/CVE-2016-6362/): Privilege escalation in n/a (high 7.8)
- [CVE-2016-6361](https://insights.sbomify.com/CVE-2016-6361/): Denial of service in n/a (medium 6.5)
- [CVE-2016-6360](https://insights.sbomify.com/CVE-2016-6360/): Denial of service in Cisco AsyncOS through WSA10.0.0-000 (high 7.5)
- [CVE-2016-6359](https://insights.sbomify.com/CVE-2016-6359/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2016-6358](https://insights.sbomify.com/CVE-2016-6358/): Denial of service in Cisco Email Security Appliance (ESA) through 9.7.1-000 (high 7.5)
- [CVE-2016-6357](https://insights.sbomify.com/CVE-2016-6357/): Security feature bypass in Cisco AsyncOS through 9.9.6-026 (high 7.5)
- [CVE-2016-6356](https://insights.sbomify.com/CVE-2016-6356/): Denial of service in Cisco AsyncOS through 9.7.0-125 (high 7.5)
- [CVE-2016-6355](https://insights.sbomify.com/CVE-2016-6355/): Denial of service in n/a (high 7.5)
- [CVE-2016-6354](https://insights.sbomify.com/CVE-2016-6354/): Memory corruption in n/a (critical 9.8)
- [CVE-2016-6353](https://insights.sbomify.com/CVE-2016-6353/): Missing authorization in n/a (medium 6.5)
- [CVE-2016-6352](https://insights.sbomify.com/CVE-2016-6352/): Memory corruption in n/a (high 7.5)
- [CVE-2016-6351](https://insights.sbomify.com/CVE-2016-6351/): Memory corruption in n/a (medium 6.7)
- [CVE-2016-6350](https://insights.sbomify.com/CVE-2016-6350/): Null dereference in n/a (medium 5.5)
- [CVE-2016-6349](https://insights.sbomify.com/CVE-2016-6349/): Information disclosure in n/a (low 3.3)
- [CVE-2016-6348](https://insights.sbomify.com/CVE-2016-6348/): JacksonJsonpInterceptor susceptible to cross-site script inclusion (XSSI) attack (medium 6.1)
- [CVE-2016-6347](https://insights.sbomify.com/CVE-2016-6347/): Improper Neutralization of Input During Web Page Generation in RESTEasy (medium 6.1)
- [CVE-2016-6346](https://insights.sbomify.com/CVE-2016-6346/): Denial of service in JBoss resteasy (high 7.5)
- [CVE-2016-6345](https://insights.sbomify.com/CVE-2016-6345/): Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy (medium 6.5)
- [CVE-2016-6344](https://insights.sbomify.com/CVE-2016-6344/): Information disclosure in n/a (medium 5.3)
- [CVE-2016-6343](https://insights.sbomify.com/CVE-2016-6343/): Cross-site scripting in Dashbuilder (medium 6.1)
- [CVE-2016-6342](https://insights.sbomify.com/CVE-2016-6342/): Missing authorization in n/a (high 7.5)
- [CVE-2016-6341](https://insights.sbomify.com/CVE-2016-6341/): Information disclosure in n/a (medium 5.5)
- [CVE-2016-6340](https://insights.sbomify.com/CVE-2016-6340/): Weak cryptography in n/a (high 8.4)
- [CVE-2016-6338](https://insights.sbomify.com/CVE-2016-6338/): Security feature bypass in n/a (medium 6.8)
- [CVE-2016-6337](https://insights.sbomify.com/CVE-2016-6337/): Auth bypass in n/a (high 7.5)
- [CVE-2016-6336](https://insights.sbomify.com/CVE-2016-6336/): Missing authorization in n/a (medium 6.5)
- [CVE-2016-6335](https://insights.sbomify.com/CVE-2016-6335/): Information disclosure in n/a (high 7.5)
- [CVE-2016-6334](https://insights.sbomify.com/CVE-2016-6334/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2016-6333](https://insights.sbomify.com/CVE-2016-6333/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2016-6332](https://insights.sbomify.com/CVE-2016-6332/): Information disclosure in n/a (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2016/page/27/